The personWho acted at each step, with delegations showing both names.
The timeWhen each step started and ended, in a clock the auditor can trust.
The values shownWhat the approver saw on the screen at the moment of the decision.
The values enteredWhat the person typed or chose.
The decisionWhich criterion held and which path was taken.
The versionWhich version of the app, and of the hierarchy, was in force.
The readWhich rows were read, from which system, under which access policy.
The writeWhich interface was called with which values, and what came back.
The notificationsWho was informed, on which channel, and what they pressed.
The overridesEvery administrator action, with a justification.
The chainA hash chain that makes any change to an earlier entry detectable.
The configuration historyWhat the rule was on any date, who changed it and why.
How to test a platform against it
Ask for one instance of one approval and read its record with the twelve items beside it. Then ask for the rule that decided it, as of the date it ran. A platform that answers both from one screen, with the auditor working alone, passes.
Bring a process; leave with an app
The first session builds the first screen on your live rows.
